2

What does ._0_3_ mean in the Ghidra decompiler?

my_string[0]._0_3_ = CONCAT12(DAT_14123b1f6,DAT_14123b1f4);
2

you need to check the relevant disassembly and retype variable

this is basically due to size difference between variable (truncation , casting ) etc

enter image description here

in the screenshot above uvar15 is a ULONGLONG a64 bit register R9:8 as shown in popup so uVar2 inherits the type

in the next line uVar2 is casted as 32 bit (uint) and orred with another 32bit entity

and stored on the lower half of 64 bit register

this is denoted in the decompiler result as uVar15._0_4_

this can also happen if a struct member type is accessed or a byte in a char array is accessed

mystring[0]._0_3_ is doing something on the 3rd( byte ,char , xxx ) of a type of some array

check your disassembly ,split the variable ,retype the variable for clarity

edit

post relevant disassembly de-compilation results without accompanying disassembly does not help

basically concat 12 is concatenating 1byte + 2byte from specified locations

so it is a total of 3 bytes
the three bytes are stored in least three bytes of a ptr mystring[0]

assume rcx = "00 00 00 00 00 00 00 00" at start
concat12(x,y) takes one char from x and two chars from y and combines them
'a'+'bc' == {61 62 63}as hex
and rcx is made to be "00 00 00 00 00 61 62 63" at end

then the operation on the Least three byte are indicated by the suffix .0_3

4
  • 1
    Sorry, I could not understand your answer enough to ask for clarification. I still don't understand what ._0_3_ means?
    – Anna
    Oct 28 '21 at 17:00
  • i tried to clarify further but doing this without relevant disassembly isn't fun
    – blabb
    Oct 28 '21 at 19:38
  • Aha so am I understanding correctly that ._0_3 refers to the least three bytes?
    – Anna
    Oct 29 '21 at 10:40
  • post disassembly without that this is mere guesswork
    – blabb
    Oct 29 '21 at 10:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.